Generalized network security policy templates for implementing similar network security policies across multiple networks

• US 6,738,908 B1
• Filed: 05/06/1999
• Issued: 05/18/2004
• Est. Priority Date: 05/06/1999
• Status: Expired due to Term

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Marvais, Nick Takaski, Bonn, David Wayne
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/306,646
• Time in Patent Office: 1,839 Days
• Field of Search: 707/9, 711/164, 713/152, 713/200, 713/201, 713/192, 713/166, 713/164, 713/159, 709/229, 709/225, 709/245, 340/5, 340/74, 380/30, 380/4, 380/23, 380/25, 380/49
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

The present invention is directed to a facility for adapting a network security policy model for use in a particular network. The facility retrieves the network security policy model, which comprises network security rules each specified with respect to one or more aliases. Each alias represents a role in a network for one or more network elements. The facility receives, for each alias included in the network security policy model, a list of one or more network elements in the network serving the role represented by the alias. The facility replaces each alias in the network security policy model with the received list of network security devices specified for the alias to produce a network security policy adapted for use in a network.

Claims

1. A method in one or more computer systems for creating network security policies for providing network security services in a plurality of protected computer networks, each protected network incorporating a plurality of network elements, by:

generating a generalized network security policy that defines one or more rules for conducting network security in a single network, each rule being specified relative to classes of network elements;

for each protected network,

generating a network profile identifying the network elements within the protected network that are members of the classes of the generalized network security policy; and

from the generalized network security policy and the network profile for the protected network, generating a specific network security policy that defines one or more rules for conducting network security in the protected network, each rule being specified relative to network elements within the protected network.

2. The method of claim 1 wherein one of the rules defined by the generated generalized network security policy is an access control rule.

3. The method of claim 1 wherein one of the rules defined by the generated generalized network security policy is a network access translation rule.

4. The method of claim 1 wherein one of the rules defined by the generated generalized network security policy is a traffic logging rule.

5. The method of claim 1 wherein one of the rules defined by the generated generalized network security policy is a notification rule.

6. The method of claim 1 wherein one of the rules defined by the generated generalized network security policy is a request blocking rule.

7. The method of claim 1, further comprising:

modifying the generated generalized network security policy; and

for each protected network,

from the modified generalized network security policy and the network profile for the protected network, generating a new specific network security policy that defines one or more rules for conducting network security in the protected network.

8. The method of claim 1, further comprising the steps of, for a selected protected network, supplementing the specific network security policy with an additional rule specified relative to network devices of the selected protocol network.

9. The method of claim 8 wherein the additional rule is specified relative to dynamic groups of network devices of the selected protected network.

10. The method of claim 8, further comprising:

modifying the generated network security policy;

from the modified network security policy and the network profile for the selected protected network, generating a new specific network security policy for the selected protected network; and

supplementing the new specific network security policy for the selected protected network with the additional rule.

11. The method of claim 1 wherein the each protected network incorporates a network security device for providing network security services in the protected network,

the method further comprising, for each protected network, using the specific network security policy generated for the protected network to configure the network security device for the network.

12. A computer-readable medium whose contents cause one or more computer systems to create network security policies for providing network security services in a plurality of computer networks, each network incorporating a plurality of network elements, by:

generating a network security policy template that defines one or more rules for conducting network security in a single network, each rule being specified relative to classes of network elements;

for each network,

generating a network profile identifying the network elements within the network that are members of the classes of the network security policy template; and

from the network security policy template and the network profile for the network, generating a network security policy that defines one or more rules for conducting network security in the network, each rule being specified relative to network elements within the network.

13. The computer-readable medium of claim 12 wherein the contents of the computer-readable medium further cause the computer systems to:

modify the generated network security policy template; and

for each network,

from the modified network security policy template and the network profile for the network, generate a new network security policy that defines one or more rules for conducting network security in the network.

14. A computer environment for developing a network security policy for a protected network, comprising:

a memory having a network security policy template allocation and a network profile allocation,

the security policy template allocation containing a security policy template defining network security directives expressed relative to network elements having specified roles, and

the network profile allocation containing a network profile identifying, for each of a plurality of the roles specified in the security policy template, one or more network elements in the protected network having the specified role; and

one or more processors that merge the network security policy template contained by the network security policy allocation with the network profile contained by the network profile allocation to produce a network security policy for the protected network.

15. The computer environment of claim 14, further comprising:

a network security device for implementing the network security policy produced by the processor.

16. The computer environment of claim 15, further comprising:

a secure communications subsystem for communicating the network security policy produced by the processor to the network security device.